Django Sep 9, 2026
7 min read
Never run django.template.Template() on HTML you didn’t write
A single stored record took an endpoint down for a week. It contained valid, working markup — for a different template language. Django compiled it anyway, because that is what you asked it to do.